Workspaces & roles

A workspace is the unit of Tablize. It contains your data, your Agent sessions, your kept assets, and your teammates. Most solo users have one. Small teams have one. Larger orgs have several, usually split by team or business unit.

This page covers who can be in a workspace, what they can do, and how to manage seats.

Roles

Four role tiers:

Role	Can do	Typical for
Owner	Everything. Billing. Delete workspace. One per workspace.	Founder, account holder.
Admin	Everything except billing and delete. Manage users, integrations, settings.	Ops leads, senior ICs.
Member	Chat with Agent. Create assets. Read everything.	Everyone doing work.
Viewer	Read Dashboards and Reports shared with them. No Agent access.	Stakeholders, clients, read-only observers.

Members and above are Creator seats — they consume tokens against the plan’s rolling allowance. Viewers are separate — $5/month per seat, no tokens.

Inviting people

Settings → Team → + Invite.

• Enter email.
• Pick role.
• Add an optional message.

The invitee gets an email with a sign-up link. If they already have a Tablize account, the link just grants access to your workspace. Otherwise, they sign up and land directly in your workspace.

Invitations expire after 7 days if not accepted.

Changing roles

Any Admin or Owner can change roles from the Team page. Downgrades take effect immediately; upgrades take effect on next login.

The Owner role can be transferred (Owner → Admin on the current owner’s account, after promoting another user). Only one Owner at a time.

Removing people

• Pause — suspend access without freeing the seat. Useful for on-leave teammates.
• Remove — remove from workspace. Their kept assets (Reports, Scripts, Apps) are transferred to an Admin unless you say otherwise. Their chat history is preserved but deactivated.
• Delete account — only the Owner can delete their own account, and only through Settings → Account.

Seats are freed immediately on remove. Billing adjusts at next invoice (prorated).

Viewer seats

Viewers are the cheapest way to share data with people who don’t need to chat. A Viewer:

• Can open any Report, Dashboard, or App explicitly shared with them.
• Can export data (CSV) from Dashboards and Reports.
• Can subscribe to a Report (daily / weekly snapshot emailed to them).
• Cannot open the Chat panel.
• Cannot see data they haven’t been shared on.

Viewer seats are $5/month, no plan dependency. Buy as many as you need.

Typical breakdown:

• Consultancy: 1 Owner + 2 Members (analysts) + 15 Viewers (clients).
• E-commerce ops team: 1 Owner + 5 Members + 3 Viewers (for exec recap).
• IoT operators: 1 Owner + 2 Members + 10 Viewers (field team reads dashboards).

Sharing assets

Every kept asset has a sharing setting:

• Private — only you.
• Team — workspace members (all roles including Viewers).
• Link — anyone with the URL, no login. Usually paired with public asset.
• Specific people — pick users by email. Creates per-user access (works for Viewers).

Viewers only see assets explicitly shared — not the whole workspace.

Permissions per domain

Some features have additional permissions beyond the role:

• Billing — Owner only. Nobody else can see payment methods or invoices.
• Integrations — Admin to connect/disconnect; Member to use.
• Destructive actions (drop table, delete integration with synced data) — Admin only, with a confirmation.
• App publish to Public — Admin only by default; can be delegated to Member.

Permissions that matter for most users: Billing (Owner only) and destructive actions (Admin with confirm).

Multi-workspace orgs

Some teams use multiple workspaces:

• One per business unit (Growth, Ops, Support).
• One per client (consultancies).
• One per environment (prod data vs sandbox).

To switch workspaces, click your workspace name in the top-left. You can belong to many workspaces with different roles in each.

For cross-workspace queries (data from workspace A shown inside workspace B), see Federation — only on Max plan.

SSO / SAML

Enterprise plan. Contact us to set up SAML, SCIM provisioning, and JIT role assignment.

For smaller teams, Google / GitHub OAuth login works out of the box and covers most “I don’t want to manage passwords” needs.

Audit log

Settings → Audit log. Shows:

• Who logged in, from where.
• Role changes.
• Invites sent and accepted.
• Integrations connected and disconnected.
• Destructive actions (table drops, workspace delete attempts).

Retained for 30 days on Plus, 1 year on Pro, indefinitely on Max. Exportable as CSV or JSON.

Common gotchas

• Invited a Viewer, they see nothing. Viewers don’t auto-see assets — you have to share each asset. Share a few Dashboards explicitly.
• Can’t promote a Member to Owner. Only the current Owner can transfer ownership, and the current Owner demotes themselves in the same action.
• Team plan seats look wrong in billing. Prorated adjustments take a day to appear on the billing page; the math is right, just delayed.
• Can’t delete a Member — error about “owns assets.” Transfer asset ownership first, then remove. The UI offers a bulk-transfer flow.

Next steps

• Billing & tokens — how seats interact with plan allowances.
• Federation — cross-workspace work on Max plan.
• Dashboards / Reports — the assets Viewers most often consume.